xloader | 9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437

General

Target

9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe
Size

793KB
MD5

f5124f581ce0f503337d22320d552f87
SHA1

03d2b9f9820957aaa9a3cdb1db2e0ff56373e444
SHA256

9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437
SHA512

01343754a765b87fcedd6a2aec979992d6c7a64c94b09b295716bb852487d55b1e9be8eb4f1eb685186f4ebee863f3ff60534857de2ae8526e489078d5c792a5

Score

10^/10

xloader ahc8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/4132-131-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe

description	pid	process	target process
PID 4336 set thread context of 4132	4336	9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe	9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe

pid	process
4132	9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe
4132	9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe

description	pid	process	target process
PID 4336 wrote to memory of 4132	4336	9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe	9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe
PID 4336 wrote to memory of 4132	4336	9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe	9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe
PID 4336 wrote to memory of 4132	4336	9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe	9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe
PID 4336 wrote to memory of 4132	4336	9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe	9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe
PID 4336 wrote to memory of 4132	4336	9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe	9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe
PID 4336 wrote to memory of 4132	4336	9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe	9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe

C:\Users\Admin\AppData\Local\Temp\9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe
"C:\Users\Admin\AppData\Local\Temp\9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4336

C:\Users\Admin\AppData\Local\Temp\9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe
"C:\Users\Admin\AppData\Local\Temp\9e19fdd001c86c5fc90e6e376f9b3240ab21355a2f24728b81ae274b26f88437.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4132-130-0x0000000000000000-mapping.dmp

Download
memory/4132-131-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4132-132-0x0000000001710000-0x0000000001A5A000-memory.dmp

Filesize
3.3MB

Download
memory/4336-124-0x0000000000FE0000-0x00000000010AC000-memory.dmp

Filesize
816KB

Download
memory/4336-125-0x0000000006080000-0x0000000006624000-memory.dmp

Filesize
5.6MB

Download
memory/4336-126-0x0000000005AD0000-0x0000000005B62000-memory.dmp

Filesize
584KB

Download
memory/4336-127-0x0000000005A70000-0x0000000005A7A000-memory.dmp

Filesize
40KB

Download
memory/4336-128-0x0000000009360000-0x00000000093FC000-memory.dmp

Filesize
624KB

Download
memory/4336-129-0x0000000009570000-0x00000000095D6000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads